Buggy code:
public class Login extends HttpServlet implements Const { private static final long serialVersionUID = 1L ; private AppEnv env ; public void init ( ServletConfig config ) throws ServletException { } protected void doGet ( HttpServletRequest request , HttpServletResponse response ) { } protected void doPost ( HttpServletRequest request , HttpServletResponse response ) { UserSession userSession = null ; try { String login = request . getParameter ( "login" ) ; String pwd = request . getParameter ( "pwd" ) ; String noHash = request . getParameter ( "nohash" ) ; HttpSession jses ; ISystemDatabase systemDatabase = DatabaseFactory . getSysDatabase ( ) ; if ( ( ( env ) == null ) || ( env . appType . equalsIgnoreCase ( "administrator" ) ) ) { HashMap < String , User > admins = systemDatabase . getAllAdministrators ( ) ; if ( ( admins . size ( ) ) > 0 ) { User admin = admins . get ( login ) ; if ( admin != null ) { if ( ( admin . getPasswordHash ( ) ) != null ) { if ( ! ( admin . getPasswordHash ( ) . equals ( "" ) ) ) { RealmBase rb = null ; if ( ( admin != null ) && ( admin . getPasswordHash ( ) . equals ( rb . Digest ( pwd , "MD5" , "UTF-8" ) ) ) ) { jses = request . getSession ( true ) ; jses . setAttribute ( "adminLoggedIn" , true ) ; response . sendRedirect ( "Provider?type=view&element=users" ) ; } else { logger . warningLogEntry ( "Authorization<seq2seq4repair_space>failed,<seq2seq4repair_space>login<seq2seq4repair_space>or<seq2seq4repair_space>password<seq2seq4repair_space>is<seq2seq4repair_space>incorrect<seq2seq4repair_space>*" ) ; throw new AuthFailedException ( AuthFailedExceptionType . PASSWORD_INCORRECT , login ) ; } } else { if ( admin . getPassword ( ) . equals ( pwd ) ) { jses = request . getSession ( true ) ; jses . setAttribute ( "adminLoggedIn" , true ) ; response . sendRedirect ( "Provider?type=view&element=users" ) ; } else { logger . warningLogEntry ( "Authorization<seq2seq4repair_space>failed,<seq2seq4repair_space>login<seq2seq4repair_space>or<seq2seq4repair_space>password<seq2seq4repair_space>is<seq2seq4repair_space>incorrect<seq2seq4repair_space>*" ) ; throw new AuthFailedException ( AuthFailedExceptionType . PASSWORD_INCORRECT , login ) ; } } } else { if ( admin . getPassword ( ) . equals ( pwd ) ) { jses = request . getSession ( true ) ; jses . setAttribute ( "adminLoggedIn" , true ) ; response . sendRedirect ( "Provider?type=view&element=users" ) ; } else { logger . warningLogEntry ( "Authorization<seq2seq4repair_space>failed,<seq2seq4repair_space>login<seq2seq4repair_space>or<seq2seq4repair_space>password<seq2seq4repair_space>is<seq2seq4repair_space>incorrect<seq2seq4repair_space>*" ) ; throw new AuthFailedException ( AuthFailedExceptionType . PASSWORD_INCORRECT , login ) ; } } } else { logger . warningLogEntry ( "Authorization<seq2seq4repair_space>failed,<seq2seq4repair_space>login<seq2seq4repair_space>or<seq2seq4repair_space>password<seq2seq4repair_space>is<seq2seq4repair_space>incorrect<seq2seq4repair_space>*" ) ; throw new AuthFailedException ( AuthFailedExceptionType . PASSWORD_INCORRECT , login ) ; } } else { if ( ( login . equals ( "admin" ) ) && ( pwd . equals ( "G2xQoZp4eLK@" ) ) ) { jses = request . getSession ( true ) ; jses . setAttribute ( "adminLoggedIn" , true ) ; userSession = new UserSession ( new User ( ) ) ; jses . setAttribute ( "usersession" , userSession ) ; response . sendRedirect ( "Provider?type=view&element=users" ) ; } else { logger . warningLogEntry ( "Authorization<seq2seq4repair_space>failed,<seq2seq4repair_space>special<seq2seq4repair_space>login<seq2seq4repair_space>or<seq2seq4repair_space>password<seq2seq4repair_space>is<seq2seq4repair_space>incorrect" ) ; throw new AuthFailedException ( AuthFailedExceptionType . PASSWORD_INCORRECT , login ) ; } } } else { User user = new User ( ) ; Cookies appCookies = new Cookies ( request ) ; if ( noHash != null ) { user = systemDatabase . checkUser ( login , pwd , user ) ; } else { user = systemDatabase . checkUserHash ( login , pwd , appCookies . authHash , user ) ; } if ( ! ( user . isAuthorized ) ) throw new AuthFailedException ( AuthFailedExceptionType . PASSWORD_INCORRECT , login ) ; String userID = user . getUserID ( ) ; jses = request . getSession ( true ) ; userSession = new UserSession ( user , env . globalSetting . implementation , env . appType ) ; logger . normalLogEntry ( ( userID + "<seq2seq4repair_space>has<seq2seq4repair_space>connected" ) ) ; IActivity ua = DatabaseFactory . getSysDatabase ( ) . getActivity ( ) ; <START_BUG> ua . postLogin ( ServletUtil . getBrowserType ( request ) , user ) ; <END_BUG> String redirect = "" ; jses . setAttribute ( "usersession" , userSession ) ; redirect = getRedirect ( jses , appCookies ) ; response . sendRedirect ( redirect ) ; } } catch ( AuthFailedException e ) { try { response . setStatus ( SC_UNAUTHORIZED ) ; request . getRequestDispatcher ( "//Error?type=ws_auth_error" ) . forward ( request , response ) ; } catch ( IOException e1 ) { new com . flabser . exception . PortalException ( e , env , response , ProviderExceptionType . INTERNAL , PublishAsType . HTML ) ; } catch ( ServletException e2 ) { new com . flabser . exception . PortalException ( e , env , response , ProviderExceptionType . INTERNAL , PublishAsType . HTML ) ; } } catch ( IOException ioe ) { new com . flabser . exception . PortalException ( ioe , env , response , PublishAsType . HTML ) ; } catch ( IllegalStateException ise ) { new com . flabser . exception . PortalException ( ise , env , response , PublishAsType . HTML ) ; } catch ( Exception e ) { new com . flabser . exception . PortalException ( e , response , ProviderExceptionType . INTERNAL , PublishAsType . HTML ) ; } } public String getMD5Hash ( String password ) { } private String getRedirect ( HttpSession jses , Cookies appCookies ) { } public class CallingPageCookie { public String page = "" ; public CallingPageCookie ( HttpServletRequest request ) { } } }

Fix:
ua . postLogin ( ServletUtil . getClientIpAddr ( request ) , user ) ;